pinomad 0.9.1 → 0.11.0

package/dist/{chunk-029mmh7d.js → chunk-as6pyf00.js}

@@ -1,9 +1,9 @@
-import {
-  packagedVersion
-} from "./chunk-fqgvf8v0.js";
 import {
   hostAddress
 } from "./chunk-ngf1zatm.js";
+import {
+  packagedVersion
+} from "./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/web-link.ts

package/dist/chunk-b457q0tm.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import {
+  readServerConfig
+} from "./chunk-etf7ef97.js";
+import {
+  argValue,
+  reachabilityLine,
+  serviceManager,
+  versionLine
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint
+} from "./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+
+// apps/host/src/cli/status.ts
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
+async function statusReport(args, deps) {
+  const dataDir = resolve(args.dataDir);
+  const manager = deps?.manager ?? serviceManager();
+  const server = await readServerConfig(dataDir);
+  const service = await manager.state();
+  const spec = service.installed ? await manager.read() : undefined;
+  const own = spec !== undefined && resolve(spec.dataDir) === dataDir;
+  const lanPort = own ? argValue(spec.hostArgs, "--remote-port") : undefined;
+  const port = own ? argValue(spec.hostArgs, "--port") : undefined;
+  return {
+    ...server === undefined ? {} : { server },
+    ...lanPort === undefined ? {} : { lanPort },
+    service,
+    ...port === undefined ? {} : { port },
+    ...spec === undefined || own ? {} : { otherDataDir: spec.dataDir }
+  };
+}
+async function main(argv) {
+  const { values } = parseArgs({ args: [...argv], options: { "data-dir": { type: "string" } } });
+  const dataDir = resolve(values["data-dir"] ?? DEFAULT_DATA_DIR);
+  try {
+    const report = await statusReport({ dataDir });
+    const { server } = report;
+    console.log(server === undefined ? `server: not joined (\`${commandHint("up")}\` to join)` : `server: ${server.username === undefined ? "joined" : server.username} at ${server.origin}`);
+    console.log(`LAN and tailnet: ${report.lanPort === undefined ? "off" : `port ${report.lanPort}`}`);
+    console.log(`service: ${report.service.installed ? report.service.detail : "not installed"}`);
+    if (report.otherDataDir !== undefined)
+      console.log(`note: the installed service runs ${report.otherDataDir}, not ${dataDir}`);
+    console.log(await versionLine());
+    console.log(await reachabilityLine([
+      "--data-dir",
+      dataDir,
+      ...report.port === undefined ? [] : ["--url", `ws://127.0.0.1:${report.port}`]
+    ]));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+export {
+  statusReport,
+  main
+};

package/dist/chunk-etf7ef97.js

@@ -0,0 +1,55 @@
+// apps/host/src/server-config.ts
+import { randomBytes } from "node:crypto";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var SERVER_CONFIG_FILE = "server.json";
+var normalizeOrigin = (origin) => origin.replace(/\/+$/, "");
+async function readServerConfig(dataDir) {
+  let text;
+  try {
+    text = await readFile(join(dataDir, SERVER_CONFIG_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is not valid JSON — delete it or run \`pinomad leave\``);
+  }
+  const origin = value?.origin;
+  if (typeof origin !== "string" || origin.trim() === "") {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is missing a string "origin"`);
+  }
+  const { binding, username } = value;
+  return {
+    origin,
+    ...typeof binding === "string" && binding !== "" ? { binding } : {},
+    ...typeof username === "string" && username !== "" ? { username } : {}
+  };
+}
+async function writeServerConfig(dataDir, config) {
+  const path = join(dataDir, SERVER_CONFIG_FILE);
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile(tmp, `${JSON.stringify({
+    origin: normalizeOrigin(config.origin),
+    binding: randomBytes(16).toString("base64url"),
+    ...config.username === undefined ? {} : { username: config.username }
+  })}
+`, { mode: 384 });
+  await rename(tmp, path);
+}
+var removeServerConfig = (dataDir) => rm(join(dataDir, SERVER_CONFIG_FILE), { force: true });
+async function readServerBinding(dataDir) {
+  return (await readServerConfig(dataDir))?.binding;
+}
+function resolveRelayOrigin(flag, config) {
+  if (flag !== undefined && config !== undefined && normalizeOrigin(flag) !== normalizeOrigin(config.origin)) {
+    throw new Error(`--relay ${flag} disagrees with ${SERVER_CONFIG_FILE} (${config.origin}) — remove one`);
+  }
+  return flag ?? config?.origin;
+}
+
+export { normalizeOrigin, readServerConfig, writeServerConfig, removeServerConfig, readServerBinding, resolveRelayOrigin };

package/dist/chunk-greb3dp6.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  joinServer,
+  main
+} from "./chunk-gtdpjqa3.js";
+import"./chunk-ncbqa8jk.js";
+import"./chunk-44pnts98.js";
+import"./chunk-t91zt5f0.js";
+import"./chunk-etf7ef97.js";
+import"./chunk-y127fe1a.js";
+import"./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import"./chunk-ngf1zatm.js";
+import"./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+export {
+  main,
+  joinServer
+};

package/dist/chunk-gtdpjqa3.js

@@ -0,0 +1,317 @@
+import {
+  assertSecureServerOrigin,
+  isSecureServerOrigin,
+  probeServerAccounts,
+  runServerOperation
+} from "./chunk-ncbqa8jk.js";
+import {
+  constantValue,
+  openHostSettings
+} from "./chunk-44pnts98.js";
+import {
+  loadHostKey,
+  loadRelayKey
+} from "./chunk-t91zt5f0.js";
+import {
+  writeServerConfig
+} from "./chunk-etf7ef97.js";
+import {
+  relayHostId
+} from "./chunk-y127fe1a.js";
+import {
+  argValue,
+  installSpec,
+  restartService,
+  serviceManager,
+  withoutRelayArgs
+} from "./chunk-vvj9b1gc.js";
+import {
+  cleanHostName,
+  normalizeHostName
+} from "./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint,
+  hostEntry
+} from "./chunk-sd5fkxjj.js";
+
+// apps/host/src/cli/join.ts
+import { mkdir } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join, resolve as resolve2 } from "node:path";
+import { parseArgs } from "node:util";
+
+// apps/host/src/cli/host-link.ts
+import { spawn } from "node:child_process";
+import { arch, platform } from "node:os";
+var SLOW_DOWN_STEP_MS = 5000;
+var REQUEST_TIMEOUT_MS = 15000;
+var EXPIRY_GRACE_MS = 2 * 60000;
+function browserCommand(os, env) {
+  if (env.SSH_CONNECTION !== undefined || env.SSH_TTY !== undefined)
+    return;
+  if (os === "darwin")
+    return "open";
+  if (os === "linux" && (env.DISPLAY !== undefined || env.WAYLAND_DISPLAY !== undefined))
+    return "xdg-open";
+  return;
+}
+function openInBrowser(url) {
+  const command = browserCommand(process.platform, process.env);
+  if (command === undefined)
+    return false;
+  try {
+    const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hostOsLabel() {
+  const os = platform();
+  const name = os === "darwin" ? "macOS" : os === "linux" ? "Linux" : os === "win32" ? "Windows" : os;
+  return `${name} (${arch()})`;
+}
+var isRecord = (value) => typeof value === "object" && value !== null;
+var errorCode = (body) => isRecord(body) && typeof body.error === "string" ? body.error : undefined;
+async function requestJoinToken(args, deps) {
+  const fetchImpl = deps?.fetch ?? fetch;
+  const sleep = deps?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const log = deps?.log ?? ((line) => console.log(line));
+  const now = deps?.now ?? Date.now;
+  const { origin } = args;
+  const timeoutMs = deps?.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
+  const post = async (path, payload) => {
+    const controller = new AbortController;
+    let timer;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve(undefined);
+      }, timeoutMs);
+    });
+    const attempt = (async () => {
+      const response = await fetchImpl(`${origin}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+        redirect: "manual",
+        signal: controller.signal
+      });
+      const text = await response.text();
+      let body2;
+      try {
+        body2 = JSON.parse(text);
+      } catch {
+        body2 = undefined;
+      }
+      return { status: response.status, body: body2 };
+    })().catch(() => {
+      return;
+    });
+    try {
+      return await Promise.race([attempt, expired]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const started = await post("/api/host-link/start", { hostId: args.hostId, name: args.name, os: args.os ?? hostOsLabel() });
+  if (started === undefined)
+    throw new Error(`cannot reach ${origin} — check the address and that the server is up`);
+  const { body } = started;
+  if (started.status !== 200) {
+    const code = errorCode(body);
+    if (started.status === 404) {
+      throw new Error(`${origin} can't confirm hosts in the browser yet — create a join token under "Add a host" and run the join command with it`);
+    }
+    if (code === "rate_limited")
+      throw new Error("too many join requests from this address — wait a few minutes and try again");
+    if (code === "busy")
+      throw new Error(`${origin} has too many hosts waiting to join right now — try again in a few minutes`);
+    throw new Error(`${origin} refused to start the join: ${code ?? `HTTP ${started.status}`}`);
+  }
+  if (!isRecord(body) || typeof body.deviceCode !== "string" || typeof body.userCode !== "string" || typeof body.verifyUrl !== "string" || typeof body.interval !== "number" || typeof body.expiresAt !== "number" || !isSecureServerOrigin(body.verifyUrl)) {
+    throw new Error(`${origin} answered the join request with something unexpected`);
+  }
+  const { deviceCode, userCode, verifyUrl, expiresAt } = body;
+  let intervalMs = Math.max(1, body.interval) * 1000;
+  const minutes = Math.max(1, Math.round((expiresAt - now()) / 60000));
+  log(`To add this host to your account on ${origin}:`);
+  log(`  1. Open ${verifyUrl} and sign in.`);
+  log(`  2. Enter this code: ${userCode}`);
+  log("");
+  log(`Only confirm it if you started this on ${args.name} (host id ${args.hostId}).`);
+  const opened = await Promise.resolve((deps?.openBrowser ?? openInBrowser)(verifyUrl)).catch(() => false);
+  log(`${opened ? "Opened the page in your browser. " : ""}Waiting for confirmation (the code expires in ${minutes} min)…`);
+  for (;; ) {
+    await sleep(intervalMs);
+    const response = await post("/api/host-link/poll", { deviceCode });
+    if (response === undefined || response.status >= 500) {
+      if (now() > expiresAt + EXPIRY_GRACE_MS) {
+        throw new Error(`the code expired before anyone confirmed it — run the command again for a new one`);
+      }
+      continue;
+    }
+    const answer = response.body;
+    if (response.status === 200 && isRecord(answer) && typeof answer.token === "string") {
+      log("Confirmed.");
+      return answer.token;
+    }
+    const code = response.status === 400 ? errorCode(answer) : undefined;
+    if (code === "access_denied")
+      throw new Error(`the join was denied on ${origin}`);
+    if (code === "expired_token")
+      throw new Error(`the code expired before anyone confirmed it — run the command again for a new one`);
+    if (code === "slow_down") {
+      const asked = isRecord(answer) && typeof answer.interval === "number" ? answer.interval * 1000 : 0;
+      intervalMs = Math.max(intervalMs + SLOW_DOWN_STEP_MS, asked);
+    } else if (code !== "authorization_pending") {
+      throw new Error(`${origin} refused the join: ${code ?? `HTTP ${response.status}`}`);
+    }
+  }
+}
+
+// apps/host/src/cli/service-slot.ts
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+async function openServiceSlot(dataDir, manager) {
+  const state = await manager.state().catch(() => ({ installed: false, running: false, detail: "unknown" }));
+  const previous = state.installed ? await manager.read() : undefined;
+  if (previous !== undefined && resolve(previous.dataDir) !== dataDir) {
+    throw new Error(`the installed service uses a different data dir (${previous.dataDir}); ` + `run this again with --data-dir ${previous.dataDir} or uninstall the service first`);
+  }
+  return { dataDir, manager, state, previous };
+}
+async function writeService(slot, edit, options) {
+  const { dataDir, manager, previous } = slot;
+  const fresh = installSpec(["--data-dir", dataDir, ...edit([])], {
+    execPath: process.execPath,
+    env: process.env,
+    home: homedir(),
+    cwd: process.cwd(),
+    mainPath: hostEntry.script,
+    entryArgs: hostEntry.args
+  });
+  if (!slot.state.installed) {
+    await manager.install(fresh);
+    return "installed";
+  }
+  const spec = previous === undefined ? fresh : { ...previous, hostArgs: edit(previous.hostArgs) };
+  const same = previous !== undefined && spec.hostArgs.join("\x00") === previous.hostArgs.join("\x00");
+  if (same && !options.changed && slot.state.running)
+    return "unchanged";
+  const port = argValue(spec.hostArgs, "--port");
+  const code = await restartService({
+    force: false,
+    argv: ["--data-dir", dataDir, ...port === undefined ? [] : ["--url", `ws://127.0.0.1:${port}`]],
+    manager,
+    restart: async () => {
+      await manager.install(spec);
+    }
+  });
+  return code === 0 ? "updated" : "failed";
+}
+
+// apps/host/src/cli/join.ts
+var message = (error) => error instanceof Error ? error.message : String(error);
+async function joinServer(args, deps) {
+  const origin = args.origin.replace(/\/+$/, "");
+  const dataDir = resolve2(args.dataDir);
+  assertSecureServerOrigin(origin);
+  if (args.name !== undefined && cleanHostName(args.name) === "") {
+    throw new Error(`Invalid host name: ${JSON.stringify(args.name)}`);
+  }
+  await mkdir(dataDir, { recursive: true });
+  const signingKey = await loadRelayKey(dataDir);
+  const hostKey = await loadHostKey(dataDir);
+  const hostId = relayHostId(signingKey.publicKey);
+  const slot = await openServiceSlot(dataDir, deps?.manager ?? serviceManager());
+  const probe = await probeServerAccounts(origin, deps?.fetch);
+  if (probe === "unreachable")
+    throw new Error(`cannot reach ${origin} — check the address and that the server is up`);
+  if (probe === "disabled") {
+    throw new Error(`${origin} does not run server accounts — the server is too old or was started without a data dir`);
+  }
+  const settings = await openHostSettings({
+    path: join(dataDir, "settings.json"),
+    fallback: {
+      defaultModel: () => null,
+      defaultThinkingLevel: () => null,
+      steeringMode: () => "one-at-a-time",
+      followUpMode: () => "one-at-a-time"
+    },
+    models: constantValue([])
+  });
+  const current = settings.value;
+  const storedName = current.custom.includes("hostName") ? current.hostName : undefined;
+  const name = normalizeHostName(args.name ?? storedName ?? deps?.hostname ?? hostname());
+  const joinToken = args.token ?? await requestJoinToken({ origin, hostId, name }, deps);
+  const reply = await runServerOperation({
+    origin,
+    signingKey,
+    noisePublicKey: hostKey.publicKey,
+    op: "join",
+    joinToken,
+    name
+  });
+  if (reply.t === "refused") {
+    throw new Error(reply.reason === "expired_token" ? "the join token expired — generate a fresh one" : reply.reason === "invalid_token" ? "the join token is invalid or already spent — generate a fresh one" : `the server refused the join: ${reply.reason}`);
+  }
+  if (reply.t !== "joined")
+    throw new Error(`unexpected answer to join: ${reply.t}`);
+  const username = reply.username;
+  let service;
+  try {
+    await writeServerConfig(dataDir, { origin, username });
+    if (args.name !== undefined)
+      await settings.update({ hostName: args.name });
+    const edit = args.editHostArgs ?? ((hostArgs) => hostArgs);
+    service = await writeService(slot, (hostArgs) => edit(withoutRelayArgs(hostArgs)), { changed: true });
+  } catch (error) {
+    throw new Error(`joined ${username} at ${origin}, but local setup failed: ${message(error)}
+` + (args.token === undefined ? `run the command again and confirm the new code (re-joining the same host is safe)` : `generate a fresh join token and run the command again (re-joining the same host is safe)`));
+  }
+  return { hostId, username, origin, service };
+}
+async function main(argv, deps) {
+  const { values, positionals } = parseArgs({
+    args: [...argv],
+    allowPositionals: true,
+    options: { "data-dir": { type: "string" }, name: { type: "string" } }
+  });
+  const [origin, token] = positionals;
+  if (origin === undefined || positionals.length > 2) {
+    console.error(`usage: ${commandHint("join")} <server-origin> [join-token] [--data-dir DIR] [--name NAME]`);
+    console.error("       without a join token, confirm the printed code in the browser where you're signed in");
+    process.exit(1);
+  }
+  try {
+    const outcome = await joinServer({
+      origin,
+      ...token === undefined ? {} : { token },
+      dataDir: values["data-dir"] ?? DEFAULT_DATA_DIR,
+      ...values.name === undefined ? {} : { name: values.name }
+    }, deps);
+    console.log(`host id: ${outcome.hostId}`);
+    console.log(`joined ${outcome.username} at ${outcome.origin}`);
+    if (outcome.service === "installed")
+      console.log("service installed and started");
+    else if (outcome.service === "updated")
+      console.log("service definition updated; host restarted when idle");
+    else {
+      console.error("joined, but the service restart did not finish — check `service status`");
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(message(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+
+export { openServiceSlot, writeService, joinServer, main };

package/dist/chunk-h5q2y57m.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  main,
+  reachabilityLine,
+  restartService,
+  versionLine
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import"./chunk-ngf1zatm.js";
+import"./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+export {
+  versionLine,
+  restartService,
+  reachabilityLine,
+  main
+};

package/dist/{chunk-4sepcfpy.js → chunk-jt34g8st.js}

@@ -15,7 +15,7 @@ import {
   organize,
   parseRtcMaxMessageSize,
   rtcSelectedPair
-} from "./chunk-jgd38rna.js";
+} from "./chunk-xqycs43g.js";
 import {
   SECURE_PROLOGUE,
   SecureSession,
@@ -24,7 +24,7 @@ import {
   initiateIK,
   isLoopbackUrl,
   parseEndpointSet
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // packages/protocol/src/remote-durable.ts
 import { applyImmutable } from "@earendil-works/chord/delta";